[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Jakub Hrozek jhrozek at redhat.com
Wed Apr 29 12:54:34 UTC 2015


On Wed, Apr 29, 2015 at 02:48:28PM +0200, Lukas Slebodnik wrote:
> On (29/04/15 14:19), Jakub Hrozek wrote:
> >On Wed, Apr 29, 2015 at 08:00:02AM -0400, Stephen Gallagher wrote:
> >> "BUG: No attrs found for GPO [%s]. This was likely caused by the GPO
> >> entry being a referred to another domain controller. SSSD does not yet
> >> support this configuration. See [insert SSSD bug number] for more
> >> information."
> >
> >I would also prefer to log into syslog/journal via sss_log() in this
> >case, to get admin's attention easily.
> It would be supperfluos.
> We will fail and there should be log message
>             sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \
>                         "have been denied GPO-based logon access if the " \
>                         "ad_gpo_access_control option were set to enforcing " \
>                         "mode.");
> 

Would this message also appear in enforcing mode? Remember there is
still Stephen's patch on the list to switch the default to enforcing.

Also, the message really doesn't tell anything about the cause of the
denial.



More information about the sssd-devel mailing list